CVE-2025-13411: Campcodes Retro Basketball Shoes Online Store admin_football.php unrestricted upload
A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/adminfootball.php. Performing a manipulation of the argument productimage results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13411?
CVE-2025-13411 has a critical severity due to the unrestricted file upload which could lead to remote code execution.
How do I fix CVE-2025-13411?
To fix CVE-2025-13411, validate and sanitize all file uploads and restrict file types and sizes in the /admin/admin_football.php functionality.
Which version of Campcodes Retro Basketball Shoes Online Store is affected by CVE-2025-13411?
CVE-2025-13411 affects version 1.0 of the Campcodes Retro Basketball Shoes Online Store.
What type of attack is possible due to CVE-2025-13411?
CVE-2025-13411 allows attackers to upload malicious files, potentially leading to unauthorized access and control of the server.
Is there a workaround for CVE-2025-13411 until a patch is available?
A temporary workaround for CVE-2025-13411 is to disable access to the /admin/admin_football.php file until a proper fix can be implemented.